Recall Three Lines distinctions in ownership conversations.
What does first line own? Delivery of objectives and management of the risks in the work. The team doing the work cannot outsource risk ownership. Second line versus third line Support is not independent assurance. Risk wrote the policy, so Risk owns the control. Risk can advise and monitor, but the process owner still owns operating the control and accepting residual risk. Letting policy authors own execution blurs accountability. It applies the Three Lines distinction without devaluing risk expertise. What should the governing body receive? Clear reporting on objectives, risks, assurance, and unresolved accountability issues. Oversight needs signals, not every…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in